Linux – Squid 2.7 : display custom error page on deny connect (503)

http-proxylinuxPROXYsquid

After some research, I finally managed to apply our company's blocked sites list to https/ssl websites using a "deny CONNECT" acl.

However, when a user tries to access a blocked website, he only sees the default 503 error page from his browser, instead of our standard access denied page.

Is there anyway to configure SQUID to display an error page instead of the browser's error page ?

Best Answer

To clarify the question, you are having problems with HTTPS sites?

I am currently investigating how to make it happen as well. Squid in the middle (breaking ssl) is an option, but one I don't want to take yet.

I split ours into two files and acl until this can get resolved. I use this for https:

deny_info TCP_RESET acl

It will not tell them to try to change network proxy settings, just saying it network connection reset.

Related Solutions

Tomcat – HTTP compression in IIS 6.0 causing problems with certain users

Ok, I think we've figured it out...

On the client side, Squid 2.5 and earlier doesn't understand "Transfer-encoding: chunked", so it delivers each chunk as the entire client request. Since it's only 1 chunk of the entire compressed request, it's invalid data and can't be read by the browser. (Not sure if this is an issue with other proxies)

On the server side, IIS always sends chunked encoding for Dynamic Compression (since IIS doesn't cache application responses, it has to compress each response on the fly, hence the chunked encoding).

The only way we can think of to fix this is to completely disable compression for HTTP 1.0 clients and only compress for HTTP 1.1 responses. The drawback is that anyone behind a proxy that sends 1.0 requests won't get compressed data and the site will load 0.5 - 1 second slower for those users.

Changes made in the metabase.xml file:

<IIsCompressionSchemes            Location ="/LM/W3SVC/Filters/Compression/Parameters"
...
HcDoOnDemandCompression="TRUE"
HcNoCompressionForHttp10="TRUE"
...
</IIsCompressionSchemes>

If anyone has a better solution, please let me know!

Ubuntu 9.10 and Squid 2.7 Transparent Proxy TCP_DENIED

You must tell squid that it is setup as a transparent system

Instead of

http_port 3128

You need

# enable the transparent option for interception caching
http_port 3128 transparent

Best Answer

Related Solutions

Tomcat – HTTP compression in IIS 6.0 causing problems with certain users

Ubuntu 9.10 and Squid 2.7 Transparent Proxy TCP_DENIED

Related Topic